The specified alg value is not allowed about auth0-django-web-app

[aaguiarz]

You need to set your client to use RS256:

[mauroka]

Hi @aaguiarz, thanks a lot for the reply.
In case I would like to support both RS256 and HS256, how can I accomplished that?
I've tried algorithms=['RS256', 'HS256'] but it throws an error:
Incorrect key type. Expected: 'oct', Recieved: RSA
jwk.py in _process_jwk, line 122

Thanks a lot.

[aaguiarz]

You can't do that with that library, you need to specify the algorithm the token has been signed with.

You should always use RS256 as HS256 can be brute-forced https://auth0.com/blog/brute-forcing-hs256-is-possible-the-importance-of-using-strong-keys-to-sign-jwts/

[mauroka]

Ok @aaguiarz.
Thanks a lot. You've really helpful.

[mauroka]

Hi @aaguiarz.
When I have to use HS256 I use PyJWT like this:
payload = jwt.decode(idToken, self.setting('SOCIAL_AUTH_AUTH0_SECRET'), algorithms=['HS256'], audience=audience, issuer=issuer)

I know it can be brute-forced but maybe someone wants to set this in Auth0 Client.
Thanks a lot for your help.